New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Why is the world still running on PHP?
SodaWithoutSparkles
Member
in General
Between the servere vulnerabilities and that the language being written in a way that is very prone to go wrong, why is everyone still running on PHP?
Comments
I think we all know the answer to this.
Slow, expensive to migrate off. And often no justification to do so at a company until something like this happens.
If it works, don't touch it
PHP is fine
PHP is lovely. ❤️
I actually think PHP was the pre-ai for lot of "intro" into development.
PHP was fast, easy ran without compiling. really was the "easy" at least for basic tasks way to get into programming.
Other than that, stubborn, expensive to to move off exactly as datahoarder said.
Easy to install , works without any configuration
And by default in many hosting platforms
Im not a fan of dealing with 4518 dependencies that are all subject to supplychain attacks for a shitty website. Just dealing with php is easier and it just works.
There is only 2 reasons, why I would switch.
As long as these 2 are fine, why bother?
There is enough software, that gets more RCE's than PHP and is still used daily.
I deploy NextJS, not fun either. Doesn't mean we shouldn't use it but I mean yeah, there is to be considered that PHP Foundation is severely understaffed this was discovered in August, if I had to chose between something I'd definitely factor that in.
I asked Muse a narrower question: why are most billing panels in PHP instead of Rust?
The answer is: plugin ecosystem.
WHMCS and Blesta have so many plugins in the form of PHP files.
Drop a file and you get a new feature.
Rust doesn’t have a stable ABI.
If one makes a billing panel in Rust, the plugin would have to be written in WebAssembly, which takes more effort.
Even if someone starts a new panel in another safe compiled language like Go, it would be an uphill battle when there are few available plugins.
Its fast to develop in.
Also the main project I develop in is half a million lines in the main repo. I'm not converting that without a damn good reason. AI or not.
Switch to HHVM.
Hack is not PHP. And all my tooling is built around PHP (PHPStan, etc)
Any large target will eventually have a vulnerability anyway. Its how they deal with it thats important. And if theres one thing this one has shown its that PHP appears to be understaffed.
Theres no excuse for not releasing packages everywhere on time and co-ordinated with the various repository hosts.
Because the alternative java application stack was captured by Oracle license vultures.
ASP from microsoft was too much a moving target, like all ms solutions.
Alternatives?
Any other will not helping to prevent vuln.
Hehehe... you're too young. :P
There was a time when Facebook released HHVM as a drop-in replacement for PHP. If I am not mistaken it was around PHP7 release date or somewhere beween 5.6 to 7.
All you had to do was literally add the repo.d/sources.list apt/yum remove php; apt/yum install hhvm. done.
There was a time when Facebook released HHVM as a drop-in replacement for PHP. If I am not mistaken it was around PHP7 release date or somewhere beween 5.6 to 7.
I am not that young. I played with it then. Like 10+ years ago.
I seem to recall limitations. But I don't remember what it didnt support.
The only I can add that was apart from what other people said is that PHP was definitely the easiest to deploy back then. Nobody could beat how low the barrier to entry was for someone to just deploy their site, especially WordPress. It was the most cheapest way to do.
Well, there is a big shift now thanks to AI. We have things like Vercel and its AI builder v0 or other competitors where you can just ask AI to build and publish on Vercel, and people are starting to do that instead.
Well... it kinda supported basic-mid PHP functionality. It started to have issues with cache, modules, auth or even the "new" object-oriented style of PHP programming.
It ran mostly on fcgi mode, which apache was not so friendly with - if I recall correctly - and even the php_mysql extension was faulty-ish; it preferred the php_mysqli way, but again - issues with object-oriented PHP.
And one major "issue" was zero compatibility with zend_extensions... anything ioncube was incompatible.
Imagine world running on java… SetForumAblazeAfterYourSunnyPostHook()
Cpu was cheap so you could always pushed more cpu or bought php optimizer or something. Also it has no dev environment just the files and the panels so it just became the de facto "need a website" language.
Tons of stuff still runs on Java. There's probably - no, definitely - more unique lines of Java running right now than PHP. Heck, there's more Java period when you think of Android.
The answer to OP's question is ecosystem and inertia, the two most powerful forces in IT.
Is it though?
Is PHP provably less secure in 2026 than, say, JavaScript? You can shoot yourself in the foot with that very easily as well.
"The language being written in a way that is very prone to go wrong" seems like a stretch to me. People do write insecure PHP. They also write insecure C and C++ and C# and everything else.
Maybe it has more to do with the fact that there's just so much PHP being written than a flaw with the language itself.
Oh, I know who's going to appear